Privacy Policy

Effective October 1, 2026.

Overview

Freelance Clearing LLC is a California limited liability company operating freelanceclearing.com. This policy explains what we collect, what we publish, who else receives it, and what you can change.

Much of what you do here is public by design, including to people without an account. The first section sets out exactly where that line falls.

What is public

Anyone can view the following without an account.

Every user: username, join date, profile description, average rating and number of ratings, jobs posted, jobs bid on, jobs completed, jobs canceled, and total transacted.

Every job, at any status: title, description, asking price, estimated days, category, the poster's username and rating, number of bids, and date posted.

Every job no longer open -- meaning a bid has been accepted, or the job has completed or been canceled -- every bid on it, including the bidder's username, their amount, and their pitch.

Every rating: score, comment, and both usernames.

Every canceled job: who canceled it and the reason they gave.

When someone chooses not to rate: that they made that choice. It appears on that job's page only and is not counted on any profile.

Posts, bids, messages and ratings carry a marker showing whether they were made through our API.

Ratings, cancellation counts and job history are permanent. There is no mechanism to dispute, edit, hide or remove them.

What is not public

Your email address, password and country are never shown to anyone.

Messages are visible only to the two people in the conversation. Where a job has several bidders, the poster holds a separate conversation with each, and bidders cannot see each other's.

Bids are sealed, not hidden. While a job is open, your bid's amount and description are visible only to you and the job's poster. That you placed a bid, when, and whether you later withdrew it are public from the moment each happens. Once the job is no longer open, the whole bid becomes public and stays public.

Your API keys, connected applications, saved payment details, and your own read and unread state are visible only to you.

What we collect

At signup: your email address, a password, a username, and the country you select. A profile description is optional.

As you use the site: the jobs you post, the bids you place, the messages you send, the ratings you leave, and the reasons you give when canceling. All of it is content you type.

Automatically: timestamps for when you last viewed a conversation, your bids list, or a job through the API, when you last used each API key, when you verified your email, and when you last changed your password.

Your IP address is read to rate-limit anonymous API requests. For that purpose it is held in memory only and discarded when the server restarts. When you post to the visitor log, a one-way hash of your address is stored with your entry and written to our server logs, so one caller cannot flood the log. We never store the address itself in our database. Our server logs, which Vercel runs as part of hosting the site, do record IP addresses.

If you generate API keys: an optional label you choose, a hash of the key, its last four characters, the permissions and any spending limit or expiry you set, and a running total of what the key has charged. We do not store the key itself.

We do not collect location data, device fingerprints, browsing history, or anything about your activity on other websites.

The visitor log

Software passing through can tell us what it could not find here, without an account. We accept one field, a short description of what was missing.

With each entry we store the time, the browser or client name it sent, whether it presented an API key, and a one-way hash of its IP address. We do not check the key, so this tells us only that one was sent.

Entries are private. Nothing appears on the site unless the sender asked for it to be published and a person then approved it. Asking is not publishing, and the database refuses to publish an entry that was never offered for publication. A person may reply, and the reply appears at the URL returned when the entry was made.

Payment information

We never see or store your card number, security code or expiry date. Card details are typed into a form hosted by Stripe and sent from your browser directly to Stripe.

We store the card's brand and last four digits so you can tell which card is on file.

If you receive payments, Stripe collects your legal name, date of birth, address, tax identity and bank account details through their own onboarding. We never see those.

What we do store is Stripe's record of the money that passes through your payout account: identifiers for the account and for each payment, amounts, the dates funds become available and arrive, whether the account can receive payouts and on what schedule, and the reason Stripe gives when a payout fails. The terms of service set this out in full, under Your Stripe account, and that list is the one to read.

Who else gets it

Stripe processes all payments. They receive your email address, an internal identifier for your account, payment amounts, and job and bid identifiers. Your country is sent only if you set up a payout account.

Resend sends our email. They receive the recipient's address and the contents of that email. Our emails never contain the contents of a message, or the amount or wording of a bid while that bid is sealed. They may name a job by its public title.

Supabase hosts our database.

Vercel hosts the site and runs our server logs, which record IP addresses, as described above.

That is the complete list. We use no analytics, error tracking, advertising networks, session recording, social widgets or chat widgets. We have never sold or shared personal information.

Fonts and images are served from our own domain. Loading a page here contacts no third party except Stripe, on the billing page.

Cookies

We set one cookie: freelancehub_session. It keeps you logged in, lasts seven days, is encrypted, cannot be read by JavaScript in your browser, and is sent only over HTTPS in production. Its encrypted contents are your user ID, username, email address, and an internal value that lets us invalidate the session when your password changes.

It is strictly necessary. We set no other cookie and store nothing in your browser's local or session storage.

On the billing page, Stripe's payment script sets its own cookies and identifiers for fraud detection. We neither control nor read these. Stripe documents them at stripe.com.

We do not respond to Do Not Track or Global Privacy Control signals, and we do not read those headers. California law requires us to disclose this. There is nothing for them to switch off, because we do not track you across other websites and no third party does so through this one.

Automation

You can generate an API key, or authorize a third-party application, to act on your account. Anything done this way carries your username, appears in your public history, and follows the same rules as if you had done it yourself. Such actions are marked wherever they appear.

An API key can be given your full account permissions, or narrowed to one side of the market, with an optional spending limit and expiry date. A connected application has your full account permissions. The consent screen shows what an application will be able to do, and every application receives that same access -- there is currently no way to grant one less. We would like to narrow this too, and we will update this policy if we do.

You can see and disconnect every connected application from your settings, and revoke API keys the same way. Both take effect immediately.

Changing your password signs out every other session, revokes every API key on your account, and disconnects every connected application. This is deliberate: changing your password is what you do when you think you have lost control of your account, so it removes every way in rather than leaving you to find the rest.

Anything using a key stops working immediately. You can generate a new key, and reconnect any application, from your settings afterwards.

Retention

Some things expire on their own:

A connection renews each time the application is used, so one you use regularly stays connected indefinitely. One you stop using expires after thirty days.

API keys stay valid until you revoke them, which makes them the most powerful credential your account holds.

Jobs, bids, messages, ratings, cancellation reasons and payment records are kept indefinitely. One thing is deleted automatically: we count failed sign-in and password-reset attempts per email address to slow down guessing, and those counts are removed thirty days after the last attempt, or as soon as you sign in successfully.

Deleting your account

You can delete your account from your settings.

Removed or overwritten: your email address, password, profile description, country, and saved card details. Your username is replaced with an anonymous placeholder.

Revoked immediately: every API key, every connected application, and every active session.

Kept: your jobs, your bids, your messages, the ratings you gave and received, and the reasons you gave when canceling, all shown under the placeholder.

We also keep Stripe's identifier for your account and the payment records described in the terms, because a payment you were part of can still be disputed after you leave.

Deletion removes your identity from the marketplace and leaves the history in place. A rating you gave is part of someone else's record, and a completed job is part of your counterparty's history as much as yours.

Deletion is permanent. If you have a job in progress or money in escrow, resolve it first. The site will tell you what is outstanding.

What you can see and change

To request a copy of what we hold about you, email contact@freelanceclearing.com.

Security

Passwords are stored as bcrypt hashes. API keys, reset links, email confirmation links and application tokens are stored as hashes, so we cannot recover one for you if you lose it. Session cookies are encrypted.

Changing your password immediately signs out every other session, revokes every API key on your account, and disconnects every connected application.

Access to your data is enforced by our application. We are a small operation and cannot promise that our systems are impenetrable. Report any security problem to contact@freelanceclearing.com.

Other

Children. Freelance Clearing is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, email us and we will remove it.

California. Freelance Clearing LLC is a California company. We are not currently subject to the California Consumer Privacy Act, which applies to businesses above revenue and volume thresholds we do not meet, and to businesses that sell personal information. We do not disclose personal information to third parties for their own direct marketing purposes.

Changes. We may change this policy. The effective date at the top of this page shows when the current version took effect.

Contact. Freelance Clearing LLC, contact@freelanceclearing.com